S T a T E O F M I C H I G a N Before the Michigan Public

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

S T A T E O F M I C H I G A N

BEFORE THE MICHIGAN PUBLIC SERVICE COMMISSION

* * * * *

In the matter, on the Commission’s own motion, ) to review issues concerning customer information ) and data privacy related to advanced metering ) Case No. U-17102 infrastructure deployment. ) )

At the October 17, 2013 meeting of the Michigan Public Service Commission in Lansing,

Michigan.

PRESENT: Hon. John D. Quackenbush, Chairman Hon. Greg R. White, Commissioner Hon. Sally A. Talberg, Commissioner

ORDER

History of Proceedings

On January 12, 2012, the Commission issued an order opening Case No. U-17000 in response to concerns raised by some individuals and local governments regarding the deployment of advanced metering infrastructure (AMI) by electric utilities in Michigan. In that order, the

Commission directed all regulated electric utilities to submit information regarding various issues in AMI deployment including the collection of customer information and data privacy. After the submissions by the utilities, the Commission provided interested persons with an opportunity to comment.

Following the deadline for the submission of comments, the Commission Staff (Staff) was directed to prepare a report for the Commission’s consideration. Specifically, the Staff was asked to summarize the filings from the utilities and interested persons, independently review the Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

literature regarding AMI, and identify any developments in other jurisdictions pertinent to the investigation. At the end of its report, the Staff was directed to make its recommendations concerning further deployment of AMI.

In its report, the Staff stated, inter alia, that customer data privacy is a priority for customers, energy providers, and the Commission. The Staff also observed that data protection standards, practices, and procedures are constantly evolving and are being updated at the national and state levels. The Staff recommended that customer data privacy be addressed through utility tariffs or rulemaking. In an order issued on September 11, 2012 in Case No. U-17000, the Commission discussed the Staff’s recommendations and found that the matter of customer data privacy was sufficiently important to merit the creation of this docket for the specific purpose of addressing customer data privacy.

On October 31, 2012, the Commission issued an order in this docket (October 31 order), in which it directed Consumers Energy Company (Consumers) and The Detroit Edison Company

(Detroit Edison)1 to provide comments on a customer privacy framework that the Commission proposed after a review of best practices. In addition, the companies were directed to respond to several questions related to customer data privacy. Comments and responses were received from

Detroit Edison, Consumers, and several interested parties. On June 28, 2013, the Commission issued an order (June 28 order) discussing the comments and revising the privacy framework. The

Commission also attached a model privacy policy created by the Staff, which the Commission found was “an example of a reasonable privacy policy that balances the interests of the company in providing reliable utility service with the interests of customers in assuring that their information is collected, used, and disclosed appropriately.” June 28 order, p. 11. Finally, the

1 Detroit Edison is now DTE Electric Company.

Page 2 U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Commission directed DTE Electric Company, DTE Gas Company, and Consumers to file proposed customer data privacy tariffs for public comment in this docket. On August 27, 2013, the companies filed proposed tariffs. Comments were subsequently received from Thomas J.

Moran, Michelle Rison, Deanna Hilbert, and Joseph and Teresa Pilarz.

Discussion

As the Commission has discussed in previous orders in this docket, and in Case No. U-17000, because utilities today provide a much wider range of services and programs, these companies now collect a far greater amount of customer data and information than they did even a decade ago. At the same time, utility customers continue to have a reasonable expectation of privacy related to the information that utilities collect, maintain, and disclose, including energy usage data and information provided by some customers and used for the implementation and evaluation of various utility programs. Using the framework established and refined in the October 31 and June

28 orders, the Commission endeavored to strike a reasonable balance between the companies’ need for information to facilitate the provision of safe, reliable, energy service and to comply with new legislative mandates, with customers’ expectations regarding the collection, disclosure, and use of their data and personal information.

In summary, the Commission has determined that an acceptable data privacy policy should limit the collection, use, or disclosure of any customer information to accomplishing primary utility purposes only. Primary utility purposes should encompass not only traditional utility service but should also include all other regulated programs including energy efficiency, demand management, renewable energy, and low-income programs. However, should a utility wish to collect, use, or disclose customer information for a secondary (i.e., non-utility) purpose, the utility must obtain informed consent from the customer in advance. In addition, the privacy policy

Page 3 U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

should assure that all customer information is protected from unauthorized use or disclosure by utility affiliates and contractors or agents. And a utility privacy policy must ensure that a customer, or a third-party authorized by that customer, is not impeded in accessing the customer’s information in accordance with the customer’s request. Finally, while the Commission briefly discussed the Code of Conduct in the June 28 order, it should be clarified that a data privacy tariff that applies to regulated utility service does not supersede the Code of Conduct.

The Commission has reviewed the proposed tariffs filed by Consumers and the DTE companies, attached as Exhibit A, and finds them in compliance with the framework established in the October 31 and June 28 orders.

THEREFORE, IT IS ORDERED that:

A. Within 30 days of the date of this order, DTE Gas Company, DTE Electric Company, and

Consumers Energy Company shall file customer data privacy tariffs substantially similar to those contained in Exhibit A attached to this order.

B. Within 30 days of the date of this order, DTE Gas Company, DTE Electric Company, and

Consumers Energy Company shall display a link to the customer data privacy tariff prominently on their respective websites.

The Commission reserves jurisdiction and may issue further orders as necessary.

Page 4 U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Any party desiring to appeal this order must do so in the appropriate court within 30 days after issuance and notice of this order, under MCL 462.26.

MICHIGAN PUBLIC SERVICE COMMISSION

______John D. Quackenbush, Chairman

______Greg R. White, Commissioner

______Sally A. Talberg, Commissioner

By its action of October 17, 2013.

______Mary Jo Kunkle, Executive Secretary

Page 5 U-17102 EXHIBIT A Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Electric Original Sheet No. C-74.00 DTE Electric Company (Customer Protections U-17102)

(Continued from Sheet No. C-74.00)

C14 CUSTOMER PROTECTIONS

C14.1 DATA PRIVACY A. “Aggregate Data” means any Customer Account Information from which all identifying information has been removed so that the individual data or information of a customer cannot be associated with that customer without extraordinary effort.

B. “Contractor” or “Company Agent” means an entity or person performing a function or service under contract with or on behalf of the Company, including, but not limited to customer service, demand response, energy management, energy efficiency programs, payment assistance, payroll services, bill collection, or other functions related to providing electric and natural gas service.

C. “Customer” means a purchaser of electricity or natural gas that is supplied or distributed by a utility for residential or nonresidential purposes.

D. “Customer Account Information” means individually identifiable information including Personal Data and Customer Usage Data. Customer Account Information also includes information received by the Company from the customer for purposes of participating in regulated utility programs, including, but not limited to bill payment assistance, shutoff protection, renewable energy, demand-side management, load management, or energy efficiency.

E. “Customer Usage Data” [or “Consumption Data”] means customer specific gas and electric usage data, including but not limited to ccf, Mcf, therms, dth, kW, kWh, voltage, var, or power factor, and other information that is recorded by the electric or gas meter for the Company and stored in its systems.

F. “Informed Customer Consent” means, in the case where consent is required: the customer is advised of the (1) data or information to be collected and allowable uses of that data or information by the party seeking consent; (2) the frequency of data or information release and the duration of time for which the consent is valid; and (3) process by which the customer may revoke consent. In no case shall silence by the customer ever be construed to mean Informed Customer Consent. Customer consent must be documented and may be in writing, electronically, or through recording of an oral communication.

G. “Personal Data” [or “Personally Identifiable Information”] means specific pieces of information collected or known by the Company that can be used to identify or trace to a specific individual and that merit special protection including, but not limited to, the standard types of positive identification information used to establish an account. Personal Data [Personally Identifiable Information] includes, but is not limited to, name, address, birth date, telephone number, electronic mail address, Social Security Number, financial account numbers, driver’s license number, credit reporting information, bankruptcy or probate information, health information, network, or Internet protocol address.

(Continued on Sheet No. C-74.01)

Issued ______, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Electric Original Sheet No. C-74.01 DTE Electric Company (Customer Protections U-17102)

(Continued from Sheet No. C-74.00)

C14 CUSTOMER PROTECTIONS (Contd.)

H. “Primary Purpose” means the collection, use, or disclosure of information collected by the company or supplied by the customer where there is an authorized business need or emergency response in order to: (1) provide, bill, or collect for, regulated electric or natural gas service; (2) provide for system, grid, or operational needs; (3) provide services as required by state or federal law or as specifically authorized in the Company’s approved tariff or; (4) plan, implement, or evaluate, energy assistance, demand response, energy management, or energy efficiency programs by the Company or under contract with the Company, under contract with the Commission, or as part of a Commission-authorized program conducted by an entity under the supervision of the Commission, or pursuant to state or federal statutes governing energy assistance.

I. “Secondary Purpose” means any purpose that is not a Primary Purpose.

J. “Standard Usage Information” means the usage data that is made available by the electric or gas utility to all similarly situated customers on a regular basis, delivered by the electric or gas utility in a standard format.

K. “Third-party” means a person or entity that has no contractual relationship with the Company to perform services or act on behalf of the Company.

COLLECTION AND USE OF DATA AND INFORMATION

A. The Company, its Contractor or Company Agent collects Customer Account Information as necessary to accomplish Primary Purposes only. Informed Customer Consent is NOT necessary for Primary Purposes.

B. Informed Customer Consent is necessary before collection or use of Customer Account Information for a Secondary Purpose.

C. The Company will not sell Customer Account Information, except in connection with sales of certain aged receivables to collection firms for purposes of removing this liability from its accounts, unless it receives Informed Customer Consent.

DISCLOSURE WITHOUT CUSTOMER CONSENT

A. The Company shall disclose Customer Account Information when required by law or Commission requests or rules. This includes law enforcement requests supported by warrants or court orders specifically naming the customers whose information is sought, and judicially enforceable subpoenas. The provision of such information will be reasonably limited to the amount authorized by law or reasonably necessary to fulfill a request compelled by law.

B. Informed Customer Consent is not required for the disclosure of customer name and address to a provider of appliance repair services in compliance with MCL 460.10a(9)(a).

(Continued on Sheet No. C-74.02)

M.P.S.C. No. 1 - Electric Original Sheet No. C-74.02 DTE Electric Company (Customer Protections U-17102

(Continued from Sheet No. C-74.01)

C14 CUSTOMER PROTECTIONS (Contd.)

C. Informed Customer Consent is not required for the disclosure of Aggregated Data

DISCLOSURE TO COMPANY AGENTS AND CONTRACTORS

A. The Company shall disclose only the necessary Customer Account Information to Company Agents and Contractors working on behalf of the company for Primary Purposes and any other function relating to providing electric or natural gas services without obtaining Informed Customer Consent.

B. Contracts between the Company and its Company Agents or Contractors specify that all Company Agents and Contractors are held to the same confidentiality and privacy standards as the Company, its employees, and its operations. These contracts also prohibit Company Agents or Contractors from using any information supplied by the Company for any purpose not defined in the applicable contract.

C. The Company requires its Company Agents and Contractors who maintain Customer Account Information to implement and maintain reasonable data security procedures and practices appropriate to the private nature of the information received. These data security procedures and practices shall be designed to protect the Customer Account Information from unauthorized access, destruction, use, modification, or disclosure. The data security procedures and practices adopted by the Contactor or Company Agent shall meet or exceed the data privacy and security policies and procedures used by the Company to protect Customer Account Information.

D. The Company requires Company Agents and Contractors to return or destroy any Customer Account Information that it maintained and that is no longer necessary for the purpose for which it was transferred.

E. The Company maintains records of the disclosure of customer data to Company Agents and Contractors in accordance with Company record retention policies and Commission rules. These records include all contracts with the Company Agent or Contractor and all executed non- disclosure agreements.

CUSTOMER ACCESS TO DATA

A. The Customer has a right to know what Customer Account Information the Company maintains about the Customer. The Company shall not provide data to a customer which the Company considers proprietary or used for internal Company business. The Company will make a reasonable effort to respond to requests for this information within 30 business days of being contacted by the Customer.

(Continued on Sheet No. C-74.03)

M.P.S.C. No. 1 - Electric Original Sheet No. C-74.03 DTE Electric Company (Customer Protections)

(Continued from Sheet No. C-74.02)

C14 CUSTOMER PROTECTIONS (Contd.)

B. Customers have the right to share their own Customer Account Information with third parties of their choice to obtain services or products provided by those third parties. These services or products may include, but are not limited to, in-home displays, energy audits, or demand response programs.

C. Customers have the opportunity to request corrections or amendments to Customer Account Information that the Company maintains.

D. Fulfilling certain requests for data in accordance with the provisions of this tariff is consistent with the provision of normal utility service to Customers. When the data requested is Standard Usage Information, the request will be fulfilled without charge. Some requests for information extend beyond Standard Usage Information. Fulfilling these requests requires special data processing that is not a part of normal utility service and results in expenses that would not otherwise be incurred. Such requests are fulfilled at the discretion of the Company within the parameters of this Customer Data Privacy tariff. The costs of fulfilling any special requests shall be borne solely by the Customer, or third party if deemed appropriate, and be based on the specifics of the data request and the associated costs of developing, processing, and transmitting the requested data.

E. A Customer may request that his or her Customer Account Information be released to a third party of the Customer’s choice. Once the Company obtains Informed Customer Consent from the Customer, the Company is not responsible for loss, theft, alteration, or misuse of the data by third parties or customers after the information has been transferred to the customer or the Customer’s designated third party.

CUSTOMER NOTICE OF PRIVACY POLICIES

A. New Customers receive a copy of the privacy policy upon the initiation of utility service from the Company. Existing Customers receive a copy of the privacy policy once per year by whatever method is used to transmit the bill and whenever the privacy policy is amended.

B. Notice of the Company’s privacy policies will be made available and is prominently posted on the Company’s website. The notice includes a customer service phone number and Internet address where Customers can direct additional questions or obtain additional information.

LIMITATION OF LIABILITY

The Company and each of its directors, officers, affiliates, and employees that disclose Customer Information, Customer Usage Data, Personal Data or Aggregated Data to Customers, Company Agents, or Contractors, as provided in this tariff, shall not be liable or responsible for any claims for loss or damages resulting from such disclosure.

Issued______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Gas Original Sheet No. C-55.00 DTE Gas Company (Customer Protections U-17102)

(Continued from Sheet No. C-54.00)

SECTION C – PART III CUSTOMER PROTECTIONS APPLICABLE TO ALL CUSTOMERS

C12. CUSTOMER PROTECTIONS

C12.1 DATA PRIVACY

A. “Aggregate Data” means any Customer Account Information from which all identifying information has been removed so that the individual data or information of a customer cannot be associated with that customer without extraordinary effort.

C. “Customer” means a purchaser of electricity or natural gas that is supplied or distributed by a utility for residential or nonresidential purposes.

(Continued on Sheet No. C-55.01)

Issued ______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Gas Original Sheet No. C-55.01 DTE Gas Company (Customer Protections U-17102)

(Continued from Sheet No. C-55.00)

C12. CUSTOMER PROTECTIONS (Cont’d.)

identification information used to establish an account. Personal Data [Personally Identifiable Information] includes, but is not limited to, name, address, birth date, telephone number, electronic mail address, Social Security Number, financial account numbers, driver’s license number, credit reporting information, bankruptcy or probate information, health information, network, or Internet protocol address.

I. “Secondary Purpose” means any purpose that is not a Primary Purpose.

K. “Third-party” means a person or entity that has no contractual relationship with the Company to perform services or act on behalf of the Company.

COLLECTION AND USE OF DATA AND INFORMATION

B. Informed Customer Consent is necessary before collection or use of Customer Account Information for a Secondary Purpose.

(Continued on Sheet No. C-55.02)

Issued ______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Gas Original Sheet No. C-55.02 DTE Gas Company (Customer Protections U-17102)

(Continued from Sheet No. C-55.01)

C12. CUSTOMER PROTECTIONS (Cont’d.)

DISCLOSURE WITHOUT CUSTOMER CONSENT

B. Informed Customer Consent is not required for the disclosure of customer name and address to a provider of appliance repair services in compliance with MCL 460.10a(9)(a).

C. Informed Customer Consent is not required for the disclosure of Aggregated Data

DISCLOSURE TO COMPANY AGENTS AND CONTRACTORS

(Continued on Sheet No. 55.03)

Issued ______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Gas Original Sheet No. C-55.03 DTE Gas Company (Customer Protections U-17102)

(Continued from Sheet No. C-55.02)

C12. CUSTOMER PROTECTIONS (Cont’d.)

CUSTOMER ACCESS TO DATA

C. Customers have the opportunity to request corrections or amendments to Customer Account Information that the Company maintains.

CUSTOMER NOTICE OF PRIVACY POLICIES

(Continued on Sheet No. 55.04)

Issued ______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

M.P.S.C. No. 1 - Gas Original Sheet No. C-55.04 DTE Gas Company (Customer Protections U-17102)

(Continued from Sheet No. C-55.03)

C12. CUSTOMER PROTECTIONS (Cont’d.)

LIMITATION OF LIABILITY

Issued ______--, 2013 N. A. Khouri Vice President Regulatory Affairs Issued under authority of the Michigan Public Service Commission Detroit, Michigan dated ______, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment A Gas Customer Data Privacy Tariff Page 1 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-60.00

SECTION C - PART IV COMPANY RULES AND REGULATIONS (FOR ALL CUSTOMERS)

INTENT OF SECTION C - PART IV

These Company Rules and Regulations for all customers are not to supersede but are in addition to Rule B1., Technical Standards for Gas Service; Rule B2., Consumer Standards and Billing Practices for Electric and Gas Residential Service; Rule B4., Billing Practices Applicable to Non-Residential Electric and Gas Customers.

C15. CUSTOMER DATA PRIVACY

C15.1. Definitions A. “Aggregated Data” means any Consumption Data or Customer Account Information, from which all identifying information has been removed so that the individual data or information of a customer cannot be associated with that customer without extraordinary effort. B. “Commission” means the Michigan Public Service Commission. (Already defined in Section A of the tariff book) B. “Contractor” means an entity or person performing a function or service under contract with or on behalf of the Company, including customer service, demand response, energy efficiency programs, payment assistance, payroll services, bill collection, or other functions related to providing natural gas service. C. “Customer” means a purchaser of natural gas that is supplied or distributed by a utility for residential or Non- Residential purposes. D. “Customer Account Information” means individually identifiable information including customer address, contact information, payment history, account number, and amount billed. Customer Account Information also includes information received by the Company from the Customer for purposes of participating in regulated utility programs, including, but not limited to, bill payment assistance, shutoff protection, renewable energy, demand-side management, load management, or energy efficiency. E. “Consumption Data” means customer specific gas usage data, including but not limited to ccf, Mcf, therms, dth, and other information that is collected by the gas meter by the Company and stored in its systems. F. “Informed Customer Consent” means, in the case where consent is required: (1) the Customer is provided with a clear statement of the data or information to be collected and allowable uses of that data or information by the party seeking consent; (2) the frequency of data or information release and the duration of time for which the consent is valid; and (3) process by which the Customer may revoke consent. In no case shall silence by the Customer ever be construed to mean express or implied consent to a request by the Company, or its Contractors. Customer consent may be documented in writing, electronically, or through recording of an oral communication. G. “Personal Data” means specific pieces of information collected or known by the Company that merit special protection including the standard types of positive identification information used to establish an account. Personal Data includes, but is not limited to, name and address in conjunction with birth date, telephone number, electronic mail address, Social Security Number, financial account numbers, driver’s license number, credit reporting information, bankruptcy or probate information, health information, network, or Internet protocol address. H. “Primary Purpose” means the collection, use, or disclosure of information collected by the Company or supplied by the Customer in order to: (1) provide, bill, or collect for, regulated natural gas service; (2) provide for system, grid, or operational needs; (3) provide services as required by state or federal law or as specifically authorized by an order of the Commission; (4) plan, implement, or evaluate programs, products or services related to energy assistance, demand response, energy management, energy efficiency, or renewable energy programs by the Company or under contract with the Company, under contract with the Commission, or as part of a Commission-authorized program conducted by an entity under the supervision of the Commission, or pursuant to state or federal statutes governing energy assistance. (Continued on Sheet No. C-61.00) Issued XXXXXX XX, 2013 by Effective for service rendered on J. G. Russell, and after XXXXXX XX, 2013 President and Chief Executive Officer, Jackson, Michigan Issued under authority of the Michigan Public Service Commission dated XXXXXX XX, 2013 in Case No. U-17102

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment A Gas Customer Data Privacy Tariff Page 2 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-61.00 (Continued From Sheet No. C-60.00) C15. CUSTOMER DATA PRIVACY (Cond) C15.1. DEFINITIONS (Cond) I. “Secondary Purpose” means any purpose that is not a Primary Purpose. J. “Standard Usage Information” means the usage data that is made generally available by the gas utility to all similarly situated Customers on a regular basis, delivered by the gas utility in a standard format. K. “Third-party” means a person or entity that has no contractual relationship with the Company to perform services or act on behalf of the Company. C15.2 Collection and Use of Data and Information A. The Company collects Customer Account Information, Consumption Data, and Personal Data as necessary to accomplish Primary Purposes only. B. The Company may collect and use Customer Account Information, Consumption Data, and Personal Data for Primary Purposes without Informed Customer Consent C. Informed Customer Consent is necessary before collection, use, or disclosure of Customer Account Information, Consumption Data, and Personal Data for Secondary Purposes. D. The Company will not sell Customer Account Information, Consumption Data, and Personal Data except in connection with sales of certain aged receivables to collection firms for purposes of removing this liability from its accounts. C15.3 Disclosure without Informed Customer Consent A. The Company will shall disclose Customer Account Information, Consumption Data, or Personal Data when required by law or Commission rules. This includes law enforcement requests supported by warrants or court orders specifically naming the Customers whose information is sought, and judicially enforceable subpoenas. The provision of such information will be reasonably limited to the amount authorized by law or reasonably necessary to fulfill a request compelled by law. B. Informed Customer Consent is not required for the disclosure of customer name and address to a provider of appliance repair services in compliance with MCL 460.10a(9)(a), or to otherwise comply with the Code of Conduct. C. The Company may disclose Customer Account Information, Consumption Data, or Personal Data in the context of a business transaction such as an asset sale or merger to the extent permitted by law. C15.4 Disclosure to Contractors A. The Company only shares information in the smallest increment necessary for the Contractor to provide service to the Company. In some cases When practical, the Company will shall only provide aggregated data to a Contractor. B. Contracts between the Company and its Contractors specify that all Contractors are held to the same confidentiality and privacy standards as the Company, its employees, and its operations. These contracts also prohibit Contractors from using any information supplied by the Company for Secondary Purposes. C. The Company requires its Contractors who maintain Customer Account Information to implement and maintain reasonable data security procedures and practices appropriate to the private nature of the information received. These data security procedures and practices shall be designed to protect the Customer Account Information, Consumption Data, and Personal Data from unauthorized access, destruction, use, modification, or disclosure. The data security procedures and practices adopted by the Contractor shall meet or exceed the data privacy and security policies and procedures used by the Company to protect Customer Account Information, Consumption Data, and Personal Data. D. The Company requires Contractors to return or destroy any Customer Account Information, Consumption Data, or Personal Data that is no longer necessary for the purpose for which is was transferred. E. The Company maintains records of the disclosure of customer data to Contractors in accordance with Company record retention policies and Commission rules. These records include all contracts with the Contractor and all executed non-disclosure agreements. F. A Customer may request that his or her Customer Account Information or Consumption Data be released to a Third- party of the Customer’s choice. Once the Company verifies the Customer’s request, the Company is not responsible for loss, theft, alteration, or misuse of the data by Third-parties or Customers after the information has been transferred to the Customer or the Customer’s designated Third-party. (Continued on Sheet No. C-62.00) Issued XXXXXX XX, 2013 by Effective for service rendered on J. G. Russell, and after XXXXXX XX, 2013 President and Chief Executive Officer, Jackson, Michigan Issued under authority of the Michigan Public Service Commission dated XXXXXX XX, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment A Gas Customer Data Privacy Tariff Page 3 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-62.00 (Continued From Sheet No. C-61.00) C15. CUSTOMER DATA PRIVACY (Cond)

C15.5. Customer Access to Data A. The Customer has a right to know what Customer Account Information, Consumption Data, or Personal Data the Company maintains about the Customer. The Company shall not provide information to a Customer that the Company considers proprietary or used for internal Company business. The Company will make a reasonable effort to respond to requests for this information within 30 business days of being contacted by the Customer. B. Customers have the right to share their own Customer Account Information, Consumption Data, or Personal Data with Third-parties of their choice to obtain services or products provided by those Third-parties. These services or products may include, but are not limited to, in-home displays, energy audits, or demand response programs. The Company is not responsible for unauthorized disclosure or use of this information by a Third-party. The Company provides a standard and user-friendly process for Customers to request that the Company share Consumption Data with a Third-party. C. Customers have the opportunity to request corrections or amendments to Customer Account Information or Personal Data that the Company collects, stores, uses or distributes. Requests of this nature shall be made in writing. D. Fulfilling certain requests for data in accordance with the provisions of this tariff is consistent with the provision of normal utility service to our Customers. When the data requested is Standard Usage Information, the request will be fulfilled without charge. Some requests for information extend beyond Standard Usage Information. Fulfilling these requests requires special data processing that is not a part of normal utility service and results in expenses that would not otherwise be incurred. Such requests are fulfilled at the discretion of the Company within the parameters of this Data Privacy Tariff. The costs of fulfilling any special requests shall be borne solely by the Customer, and be based on the specifics of the data request and the associated costs of developing, processing, and transmitting the requested data. C15.6. Customer Notice of Privacy Policies (modified formatting of this section) A. Notice of the Company’s privacy policies is prominently posted on the Company’s website. The notice includes a customer service phone number and Internet address where Customers may direct additional questions or obtain additional information regarding how to obtain customer data or more information about the Company’s privacy policies and procedures. B. Customers receive a copy of the privacy policy upon initiating utility service with the Company. The Company shall provide a written copy of these privacy policies upon Customer request.

C15.7. Limitation of Liability The Company and each of its directors, officers, affiliates, and employees that disclose Customer Information, Consumption Data, Personal Data or Aggregated Data to Customers, Contractors, or Third-parties as provided in this tariff, shall not be liable or responsible for any claims for loss or damages resulting from such disclosure.

Issued XXXXXX XX, 2013 by Effective for service rendered on J. G. Russell, and after XXXXXX XX, 2013 President and Chief Executive Officer, Jackson, Michigan Issued under authority of the Michigan Public Service Commission dated XXXXXX XX, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment B Electric Customer Data Privacy Tariff Page 1 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-56.00

SECTION C - PART IV COMPANY RULES AND REGULATIONS (FOR ALL CUSTOMERS) INTENT OF SECTION C - PART IV

These Company Rules and Regulations for all customers are not to supersede but are in addition to Rule B1., Technical Standards for Electric Service; Rule B2., Consumer Standards and Billing Practices for Electric and Gas Residential Service; Rule B4., Billing Practices Applicable to Non-Residential Electric and Gas Customers; Rule B5., Underground Electric Lines; Rule B6., Electrical Supply and Communication Lines and Associated Equipment; Rule B7., Rules and Regulations Governing Animal Contact Current Mitigation (Stray Voltage); Rule B8., Electric Interconnection and Net Metering Standards; and Rule B9., Service Quality and Reliability Standards for Electric Distribution Systems.

C15. CUSTOMER DATA PRIVACY

C15.1. Definitions A. “Aggregated Data” means any Consumption Data or Customer Account Information, from which all identifying information has been removed so that the individual data or information of a customer cannot be associated with that customer without extraordinary effort. B. “Commission” means the Michigan Public Service Commission. (Already defined in Section A of the tariff book) B. “Contractor” means an entity or person performing a function or service under contract with or on behalf of the Company, including customer service, demand response, energy efficiency programs, payment assistance, payroll services, bill collection, or other functions related to providing electric service. C. “Customer” means a purchaser of electricity that is supplied or distributed by a utility for residential or Non- Residential purposes. D. “Customer Account Information” means individually identifiable information including customer address, contact information, payment history, account number, and amount billed. Customer Account Information also includes information received by the Company from the Customer for purposes of participating in regulated utility programs, including, but not limited to, bill payment assistance, shutoff protection, renewable energy, demand-side management, load management, or energy efficiency. E. “Consumption Data” means customer specific electric usage data, including but not limited to kW, kWh, voltage, var, power factor, and other information that is collected by the electric meter by the Company and stored in its systems. F. “Informed Customer Consent” means, in the case where consent is required: (1) the Customer is provided with a clear statement of the data or information to be collected and allowable uses of that data or information by the party seeking consent; (2) the frequency of data or information release and the duration of time for which the consent is valid; and (3) process by which the Customer may revoke consent. In no case shall silence by the Customer ever be construed to mean express or implied consent to a request by the Company, or its Contractors. Customer consent may be documented in writing, electronically, or through recording of an oral communication. G. “Personal Data” means specific pieces of information collected or known by the Company that merit special protection including the standard types of positive identification information used to establish an account. Personal Data includes, but is not limited to, name and address in conjunction with birth date, telephone number, electronic mail address, Social Security Number, financial account numbers, driver’s license number, credit reporting information, bankruptcy or probate information, health information, network, or Internet protocol address. H. “Primary Purpose” means the collection, use, or disclosure of information collected by the Company or supplied by the Customer in order to: (1) provide, bill, or collect for, regulated electric service; (2) provide for system, grid, or operational needs; (3) provide services as required by state or federal law or as specifically authorized by an order of the Commission; (4) plan, implement, or evaluate programs, products or services related to energy assistance, demand response, energy management, energy efficiency, or renewable energy programs by the Company or under contract with the Company, under contract with the Commission, or as part of a Commission-authorized program conducted by an entity under the supervision of the Commission, or pursuant to state or federal statutes governing energy assistance. (Continued on Sheet No. C-57.00) Issued XXXXXX XX, 2013 by Effective for service rendered on J. G. Russell, and after XXXXXX XX, 2013 President and Chief Executive Officer, Jackson, Michigan Issued under authority of the Michigan Public Service Commission dated XXXXXX XX, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment B Electric Customer Data Privacy Tariff Page 2 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-57.00 (Continued From Sheet No. C-56.00) C15. CUSTOMER DATA PRIVACY (Cond) C15.1. DEFINITIONS (Cond) I. “Secondary Purpose” means any purpose that is not a Primary Purpose. J. “Standard Usage Information” means the usage data that is made generally available by the electric utility to all similarly situated Customers on a regular basis, delivered by the electric utility in a standard format. K. “Third-party” means a person or entity that has no contractual relationship with the Company to perform services or act on behalf of the Company. C15.2 Collection and Use of Data and Information A. The Company collects Customer Account Information, Consumption Data, and Personal Data as necessary to accomplish Primary Purposes only. B. The Company may collect and use Customer Account Information, Consumption Data, and Personal Data for Primary Purposes without Informed Customer Consent C. Informed Customer Consent is necessary before collection, use, or disclosure of Customer Account Information, Consumption Data, and Personal Data for Secondary Purposes. D. The Company will not sell Customer Account Information, Consumption Data, and Personal Data except in connection with sales of certain aged receivables to collection firms for purposes of removing this liability from its accounts. C15.3 Disclosure without Informed Customer Consent A. The Company will shall disclose Customer Account Information, Consumption Data, or Personal Data when required by law or Commission rules. This includes law enforcement requests supported by warrants or court orders specifically naming the Customers whose information is sought, and judicially enforceable subpoenas. The provision of such information will be reasonably limited to the amount authorized by law or reasonably necessary to fulfill a request compelled by law. B. Informed Customer Consent is not required for the disclosure of customer name and address to a provider of appliance repair services in compliance with MCL 460.10a(9)(a), or to otherwise comply with the Code of Conduct. C. The Company may disclose Customer Account Information, Consumption Data, or Personal Data in the context of a business transaction such as an asset sale or merger to the extent permitted by law. C15.4 Disclosure to Contractors A. The Company only shares information in the smallest increment necessary for the Contractor to provide service to the Company. In some cases When practical, the Company will shall only provide aggregated data to a Contractor. B. Contracts between the Company and its Contractors specify that all Contractors are held to the same confidentiality and privacy standards as the Company, its employees, and its operations. These contracts also prohibit Contractors from using any information supplied by the Company for Secondary Purposes. C. The Company requires its Contractors who maintain Customer Account Information to implement and maintain reasonable data security procedures and practices appropriate to the private nature of the information received. These data security procedures and practices shall be designed to protect the Customer Account Information, Consumption Data, and Personal Data from unauthorized access, destruction, use, modification, or disclosure. The data security procedures and practices adopted by the Contractor shall meet or exceed the data privacy and security policies and procedures used by the Company to protect Customer Account Information, Consumption Data, and Personal Data. D. The Company requires Contractors to return or destroy Customer Account Information, Consumption Data, or Personal Data that is no longer necessary for the purpose for which is was transferred. E. The Company maintains records of the disclosure of customer data to Contractors in accordance with Company record retention policies and Commission rules. These records include all contracts with the Contractor and all executed non-disclosure agreements. F. A Customer may request that his or her Customer Account Information or Consumption Data be released to a Third- party of the Customer’s choice. Once the Company verifies the Customer’s request, the Company is not responsible for loss, theft, alteration, or misuse of the data by Third-parties or Customers after the information has been transferred to the Customer or the Customer’s designated Third-party. (Continued on Sheet No. C-58.00) Issued XXXXXX XX, 2013 by Effective for service rendered on J. G. Russell, and after XXXXXX XX, 2013 President and Chief Executive Officer, Jackson, Michigan Issued under authority of the Michigan Public Service Commission dated XXXXXX XX, 2013 in Case No. U-17102 Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Attachment B Electric Customer Data Privacy Tariff Page 3 of 3 M.P.S.C. No. 13 - Electric Consumers Energy Company Sheet No. C-58.00 (Continued From Sheet No. C-57.00) C15. CUSTOMER DATA PRIVACY (Cond)

C15.5. Customer Access to Data A. The Customer has a right to know what Customer Account Information, Consumption Data, or Personal Data the Company maintains about the Customer. The Company shall not provide information to a Customer that the Company considers proprietary or used for internal Company business. The Company will make a reasonable effort to respond to requests for this information within 30 business days of being contacted by the Customer. B. Customers have the right to share their own Customer Account Information, Consumption Data, or Personal Data with Third-parties of their choice to obtain services or products provided by those Third-parties. The Company is not responsible for unauthorized disclosure or use of this information by a Third-party. C. Customers have the opportunity to request corrections or amendments to Customer Account Information or Personal Data that the Company collects, stores, uses or distributes. Requests of this nature shall be made in writing. D. Fulfilling certain requests for data in accordance with the provisions of this tariff is consistent with the provision of normal utility service to our Customers. When the data requested is Standard Usage Information, the request will be fulfilled without charge. Some requests for information extend beyond Standard Usage Information. Fulfilling these requests requires special data processing that is not a part of normal utility service and results in expenses that would not otherwise be incurred. Such requests are fulfilled at the discretion of the Company within the parameters of this Data Privacy Tariff. The costs of fulfilling any special requests shall be borne solely by the Customer, and be based on the specifics of the data request and the associated costs of developing, processing, and transmitting the requested data. C15.6. Customer Notice of Privacy Policies (modified formatting of this section) A. Notice of the Company’s privacy policies is prominently posted on the Company’s website. The notice includes a customer service phone number and Internet address where Customers may direct additional questions or obtain additional information regarding how to obtain customer data or more information about the Company’s privacy policies and procedures. B. Customers receive a copy of the privacy policy upon initiating utility service with the Company. The Company shall provide a written copy of these privacy policies upon Customer request.

P R O O F O F S E R V I C E

STATE OF MICHIGAN )

Case No. U-17102

County of Ingham )

Joanna Klein being duly sworn, deposes and says that on October, 17 2013 A.D. she served a copy of the attached Commission order by first class mail, postage prepaid, or by inter-departmental mail, to the persons as shown on the attached service list.

______Joanna Klein

Subscribed and sworn to before me This 17th day of October 2013

______Gloria Pearl Jones Notary Public, Ingham County, MI My Commission Expires June 5, 2016 Acting in Eaton County

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

Service List U-17102

James A. Ault Michigan Electric & Gas Association Consumers Energy Company a/k/a CMS Energy 3073 Summergate Lane Catherine M. Reynolds Okemos MI 48864 One Energy Plaza Jackson MI 49201

Jon R. Robinson Raymond E. McQuillan VP Utility Law & Regulation Consumers Energy Company Consumers Energy Company 1 Energy Plaza Drive, Rm EP11-241 One Energy Plaza Drive, Rm 11-224 Jackson MI 49201 Jackson MI 49201

Michael J. Solo, Jr. The Detroit Edison Company DTE Energy Company Lisa A. Muschong One Energy Plaza One Energy Plaza, 2459 WCB Detroit MI 48226-1279 Detroit MI 48226-1279

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

P R O O F O F S E R V I C E

STATE OF MICHIGAN )

Case No. U-17102

County of Ingham )

Lisa Felice being duly sworn, deposes and says that on October 17, 2013 A.D. she served a copy of the attached Commission Order (Commission’s Own Motion) via e-mail transmission, to the persons as shown on the attached service list (Listserv Distribution

List).

______Lisa Felice

Subscribed and sworn to before me this 17th day of October 2013

______Gloria Pearl Jones Notary Public, Ingham County, MI As acting in Eaton County My Commission Expires June 5, 2016

Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

[email protected] Mid American [email protected] Noble Americas [email protected] Village of Baraga [email protected] Linda Brauker [email protected] Direct Energy Business/Direct Energy Service [email protected] Village of Clinton [email protected] CMS Energy Resource Mgt Co [email protected] Tri-County Electric Co-Op [email protected] Tri-County Electric Co-Op [email protected] Tri-County Electric Co-Op [email protected] Aurora Gas Company [email protected] Citizens Gas Fuel Company [email protected] Consumers Energy Company [email protected] Consumers Energy Company [email protected] Exelon Energy Company [email protected] SEMCO Energy Gas Company [email protected] Superior Energy Company [email protected] Upper Peninsula Power Company [email protected] Wisconsin Electric Power Company [email protected] Midwest Energy Coop [email protected] Midwest Energy Coop [email protected] Alger Delta Cooperative [email protected] Bayfield Electric Cooperative [email protected] Cherryland Electric Cooperative [email protected] Cloverland Electric Cooperative [email protected] Great Lakes Energy Cooperative [email protected] PowerOne Corp [email protected] Liberty Power Deleware (Holdings) [email protected] Stephson Utilities Department [email protected] Ontonagon Cnty Rural Elec [email protected] Presque Isle Electric & Gas Cooperative, INC [email protected] Thumb Electric [email protected] Bishop Energy [email protected] BlueStar Energy [email protected] CMS Energy [email protected] Commerce Energy [email protected] Constellation Energy [email protected] Constellation Energy [email protected] Constellation Energy [email protected] Constellation New Energy [email protected] Constellation New Energy [email protected] Direct Energy [email protected] Direct Energy [email protected] DTE Energy [email protected] DTE Energy [email protected] Duke Energy [email protected] Duke Energy [email protected] First Energy Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

[email protected] Glacial Energy [email protected] Just Energy [email protected] Lakeshore Energy [email protected] MidAmerican Energy [email protected] Mx Energy [email protected] My Choice Energy [email protected] Noble American Energy [email protected] Santana Energy [email protected] Spartan Renewable Energy, Inc. (Wolverine Po [email protected] Xcel Energy [email protected] City of Escanaba [email protected] City of Crystal Falls [email protected] Lisa Felice [email protected] Michigan Gas & Electric [email protected] City of Gladstone [email protected] Integrys Group [email protected] Lisa Gustafson [email protected] Tim Hoffman [email protected] Interstate Gas Supply Inc [email protected] Thomas Krichel [email protected] Bay City Electric Light & Power [email protected] Grand Haven Board of Light & Power [email protected] Lansing Board of Water and Light [email protected] Marquette Board of Light & Power [email protected] Premier Energy Marketing LLC [email protected] U.P. Power Marketing, LLC [email protected] City of Marshall [email protected] Steven McLean [email protected] Doug Motley [email protected] Mary Jo Kunkle - MPSC [email protected] Nicholas Nwabueze [email protected] Marc Pauley [email protected] City of Portland [email protected] Alpena Power [email protected] Liberty Power [email protected] Wabash Valley Power [email protected] Wolverine Power [email protected] Lowell S. [email protected] Integrys Energy Service, Inc WPSES [email protected] Lakeshore Energy Services [email protected] Realgy Energy Services [email protected] Volunteer Energy Services [email protected] Wyandotte Municipal Services [email protected] Wyandotte Municipal Services [email protected] First Energy Solutions [email protected] Noble Energy Solutions [email protected] Coldwater Board of Public Utilities [email protected] Hillsdale Board of Public Utilities Filed with the Iowa Utilities Board on September 23, 2019, TF-2018-0030

[email protected] Hillsdale Board of Public Utilities [email protected] Mich Gas Utilities/Upper Penn Power/Wisconsi [email protected] Mich Gas Utilities/Qwest [email protected] Stephanie Williams [email protected] Zeeland Board of Public Works